Description
The Cisco Intrusion Prevention System (IPS) and IOS with Firewall/IPS Feature Set do not properly handle certain full-width and half-width Unicode character encodings, which might allow remote attackers to evade detection of HTTP traffic.
References
- oval:org.mitre.oval:def:5465 vdb-entry signature
- 35336 vdb-entry
- VU#739224 third-party-advisory
- ADV-2007-1803 vdb-entry
- 1018053 vdb-entry
- http://www.gamasec.net/english/gs07-01.html
- 25285 third-party-advisory
- 1018054 vdb-entry
- 23980 vdb-entry
- 20070514 HTTP Full-Width and Half-Width Unicode Encoding Evasion vendor-advisory
- cisco-scanengine-unicode-security-bypass(34277) vdb-entry
- 20070515 GS07-01 Full-Width and Half-Width Unicode Encoding IDS/IPS/WAF Bypass Vulnerability mailing-list